@cosmicdrift/kumiko-bundled-features 0.149.2 → 0.151.0

package/src/sessions/constants.ts

@@ -17,6 +17,8 @@ export const SessionQueries = {
   // Admin-scoped: all sessions in the caller's tenant (live + revoked).
   // Tenant isolation comes from ctx.db; access-gate is admin-or-higher.
   list: "sessions:query:user-session:list",
+  // Admin-scoped single-session inspector, backs the session-detail screen.
+  detail: "sessions:query:user-session:detail",
 } as const;
 
 export const SessionErrors = {
@@ -45,3 +47,6 @@ export const DEFAULT_SESSION_CACHE_TTL_MS = 60_000;
 // longer so refresh can rotate the token without requiring a new password).
 // MVP ships a single window; per-app overrides can come later.
 export const DEFAULT_SESSION_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
+
+export const SESSION_LIST_SCREEN_ID = "session-list" as const;
+export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;

package/src/sessions/feature.ts

@@ -1,11 +1,18 @@
 import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SessionQueries } from "./constants";
 import { cleanupJob } from "./handlers/cleanup.job";
+import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
 import { mineQuery } from "./handlers/mine.query";
 import { revokeWrite } from "./handlers/revoke.write";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
+import { SESSIONS_I18N } from "./i18n";
 import { userSessionEntity } from "./schema/user-session";
 import type { SessionAllOthersRevoker, SessionMassRevoker } from "./session-callbacks";
 
@@ -105,6 +112,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     const queries = {
       mine: r.queryHandler(mineQuery),
       list: r.queryHandler(listQuery),
+      detail: r.queryHandler(detailQuery),
     };
 
     // Retention: chunked DELETE of expired/revoked rows. Manual trigger
@@ -143,6 +151,64 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       autoRevoke ??= revoker;
     };
 
+    r.translations({ keys: SESSIONS_I18N });
+
+    const listAccess = { roles: access.admin };
+
+    r.screen({
+      id: SESSION_LIST_SCREEN_ID,
+      type: "projectionList",
+      query: SessionQueries.list,
+      columns: [
+        { field: "id", label: "sessions.list.col.id" },
+        { field: "userId", label: "sessions.list.col.userId" },
+        { field: "createdAt", label: "sessions.list.col.createdAt" },
+        { field: "expiresAt", label: "sessions.list.col.expiresAt" },
+        { field: "revokedAt", label: "sessions.list.col.revokedAt" },
+      ],
+      rowActions: [
+        {
+          kind: "navigate",
+          id: "open",
+          label: "sessions.list.action.open",
+          screen: SESSION_DETAIL_SCREEN_ID,
+          entityId: "id",
+          rowClick: true,
+        },
+      ],
+      access: listAccess,
+    });
+    r.screen({
+      id: SESSION_DETAIL_SCREEN_ID,
+      type: "projectionDetail",
+      query: SessionQueries.detail,
+      listScreenId: SESSION_LIST_SCREEN_ID,
+      layout: {
+        sections: [
+          {
+            fields: ["id", "userId", "createdAt", "expiresAt", "revokedAt", "ip", "userAgent"],
+          },
+        ],
+      },
+      fieldLabels: {
+        id: "sessions.detail.field.id",
+        userId: "sessions.detail.field.userId",
+        createdAt: "sessions.detail.field.createdAt",
+        expiresAt: "sessions.detail.field.expiresAt",
+        revokedAt: "sessions.detail.field.revokedAt",
+        ip: "sessions.detail.field.ip",
+        userAgent: "sessions.detail.field.userAgent",
+      },
+      access: listAccess,
+    });
+    r.nav({
+      id: "session-list",
+      label: "sessions:nav.sessionList",
+      icon: "list",
+      screen: "sessions:screen:session-list",
+      order: 10,
+    });
+
     return { handlers, queries, bindAutoRevokeOnPasswordChange };
   });
 }

package/src/sessions/handlers/detail.query.ts

@@ -0,0 +1,36 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
+import { userSessionTable } from "../schema/user-session";
+
+// Admin single-session inspector — mirrors list.query's decrypt handling for
+// the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
+export const detailQuery = defineQueryHandler({
+  name: "user-session:detail",
+  schema: z.object({ id: z.uuid() }),
+  access: { roles: access.admin },
+  handler: async (query, ctx) => {
+    const row = await fetchOne<{
+      id: string;
+      userId: string;
+      createdAt: unknown;
+      expiresAt: unknown;
+      revokedAt: unknown;
+      ip: string | null;
+      userAgent: string | null;
+    }>(ctx.db, userSessionTable, { id: query.payload.id });
+    if (!row) return null;
+    return {
+      id: row.id,
+      userId: row.userId,
+      createdAt: row.createdAt,
+      expiresAt: row.expiresAt,
+      revokedAt: row.revokedAt,
+      ip: row.ip ? await decryptStoredPii(row.ip, "sessions:detail") : row.ip,
+      userAgent: row.userAgent
+        ? await decryptStoredPii(row.userAgent, "sessions:detail")
+        : row.userAgent,
+    };
+  },
+});

package/src/sessions/i18n.ts

@@ -0,0 +1,23 @@
+// @runtime client
+// Server + client i18n for the sessions operator screens.
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const SESSIONS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:session-list.title": { de: "Sitzungen", en: "Sessions" },
+  "screen:session-detail.title": { de: "Sitzung", en: "Session" },
+  "sessions:nav.sessionList": { de: "Sitzungen", en: "Sessions" },
+  "sessions.list.col.id": { de: "ID", en: "ID" },
+  "sessions.list.col.userId": { de: "User-ID", en: "User ID" },
+  "sessions.list.col.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.list.col.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.list.col.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.list.action.open": { de: "Details", en: "Details" },
+  "sessions.detail.field.id": { de: "ID", en: "ID" },
+  "sessions.detail.field.userId": { de: "User-ID", en: "User ID" },
+  "sessions.detail.field.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.detail.field.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.detail.field.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.detail.field.ip": { de: "IP-Adresse", en: "IP address" },
+  "sessions.detail.field.userAgent": { de: "User-Agent", en: "User agent" },
+};

package/src/shared/index.ts

@@ -9,4 +9,5 @@ export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export type { SystemQueryFn } from "./system-query";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/shared/system-query.ts

@@ -0,0 +1,5 @@
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
+// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
+// isn't part of the engine's public surface (only the httpRoute-
+// registration types are).
+export type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -14,7 +14,6 @@ import {
 import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -23,6 +22,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -0,0 +1,163 @@
+// #1057 regression: anonymous GDPR magic-link download under
+// `resolverTrust: "authoritative"` WITHOUT `defaultTenantId` (publicstatus's
+// real prod config — Host-Resolver-only, no single-tenant fallback).
+//
+// The tenantResolver derives the ambient tenant from the request Host — here
+// it always resolves to `hostTenant`, DIFFERENT from the tenant the export
+// job actually belongs to (`jobTenant`). Before the fix, `download-by-token`
+// resolved the file-storage-provider *selection* via `ctx.config`, which is
+// bound to the ambient (resolved) tenant — `hostTenant` has no provider
+// configured at all here, so the download 500s even though the token/job
+// themselves are perfectly valid. The fix resolves the provider explicitly
+// for `jobRow.requestedFromTenantId` instead.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createInMemoryFileProvider,
+  type FileStorageProvider,
+} from "@cosmicdrift/kumiko-framework/files";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { ConfigHandlers } from "../../config/constants";
+import { createConfigAccessorFactory } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDataRetentionFeature } from "../../data-retention";
+import { fileFoundationFeature } from "../../file-foundation";
+import { fileProviderInMemoryFeature } from "../../file-provider-inmemory";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runExportJobs } from "../run-export-jobs";
+import { exportDownloadTokenEntity } from "../schema/download-token";
+import { exportJobEntity } from "../schema/export-job";
+
+const jobTenant = testTenantId(1);
+const hostTenant = testTenantId(2);
+const jobTenantAdmin = createTestUser({ id: 99, tenantId: jobTenant, roles: ["TenantAdmin"] });
+const aliceUser = createTestUser({ id: 42, tenantId: jobTenant, roles: ["Member"] });
+
+const providerPerTenant = new Map<string, ReturnType<typeof createInMemoryFileProvider>>();
+function buildProvider(tenantId: string): Promise<FileStorageProvider> {
+  let p = providerPerTenant.get(tenantId);
+  if (!p) {
+    p = createInMemoryFileProvider();
+    providerPerTenant.set(tenantId, p);
+  }
+  return Promise.resolve(p);
+}
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      fileFoundationFeature,
+      fileProviderInMemoryFeature,
+      createSessionsFeature(),
+      createUserDataRightsFeature(),
+    ],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      configEncryption: encryption,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+    // publicstatus prod: Host-Resolver-only, NO defaultTenantId. Resolver
+    // always answers `hostTenant` here — jobTenant never appears as the
+    // ambient/resolved tenant, only ever as jobRow.requestedFromTenantId.
+    anonymousAccess: {
+      tenantResolver: () => hostTenant,
+      resolverTrust: "authoritative",
+      tenantExists: async (id) => id === jobTenant || id === hostTenant,
+    },
+  });
+  await unsafeCreateEntityTable(stack.db, exportJobEntity);
+  await unsafeCreateEntityTable(stack.db, exportDownloadTokenEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+
+  // Only jobTenant gets a provider configured — hostTenant deliberately has
+  // NONE, so a pre-fix ambient-tenant read would hard-fail with "no provider
+  // selected", not just pick the wrong one.
+  await stack.http.writeOk(
+    ConfigHandlers.set,
+    { key: "file-foundation:config:provider", value: "inmemory" },
+    jobTenantAdmin,
+  );
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("download-by-token under resolverTrust: authoritative, no defaultTenantId", () => {
+  test("magic-link download succeeds via the job's own tenant, not the Host-resolved ambient tenant", async () => {
+    const requestRes = await stack.http.writeOk<{ jobId: string }>(
+      "user-data-rights:write:request-export",
+      {},
+      aliceUser,
+    );
+    const jobId = requestRes.jobId;
+    const provider = await buildProvider(jobTenant);
+    await provider.write(`${jobTenant}/exports/${jobId}.zip`, new Uint8Array([1, 2, 3]));
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: getTemporal().Now.instant(),
+    });
+    const plainToken = result.tokenByJobId.get(jobId);
+    if (!plainToken) {
+      throw new Error("token-create failed in worker run");
+    }
+
+    const res = await stack.app.fetch(
+      new Request(`http://test/user-export/by-token?token=${plainToken}`, { method: "GET" }),
+    );
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location");
+    expect(location).toMatch(/^memory:\/\//);
+    expect(location).toContain(`${jobTenant}/exports/${jobId}.zip`);
+  });
+});

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -559,4 +559,43 @@ describe("download-by-job :: cross-user + cross-tenant", () => {
     );
     expect(result.url).toMatch(/^memory:\/\//);
   });
+
+  test("cross-tenant same-user: provider is resolved for the job's tenant, not the ambient session tenant", async () => {
+    // #1057 regression: createFileProviderForTenant used to read the
+    // provider *selection* from the ambient session's ctx.config — here
+    // Tenant B (Alice's session tenant) — instead of the job's own
+    // Tenant A. Give Tenant A a provider WITHOUT getSignedUrl while
+    // Tenant B keeps "inmemory" (default from beforeEach): if the bug
+    // resurfaces, the wrong (Tenant B) provider is picked and the
+    // request succeeds with 200 instead of 422.
+    const { jobId } = await seedDoneJobWithToken();
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: "file-foundation:config:provider", value: "no-signed-url" },
+      tenantAdmin, // Tenant A admin
+    );
+    const aliceFromTenantB = createTestUser({
+      id: 42,
+      tenantId: tenantB,
+      roles: ["Member"],
+    });
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_tenant_memberships (tenant_id, user_id)
+      VALUES ($1, $2)
+      ON CONFLICT (user_id, tenant_id) DO NOTHING
+    `,
+      [tenantB, String(aliceUser.id)],
+    );
+
+    const res = await stack.http.query(
+      "user-data-rights:query:download-by-job",
+      { jobId },
+      aliceFromTenantB,
+    );
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error: { code: string; i18nKey: string } };
+    expect(body.error.code).toBe("unprocessable");
+    expect(body.error.i18nKey).toBe("userDataRights.errors.download.signedUrlNotSupported");
+  });
 });

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -46,7 +46,6 @@ import {
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -60,6 +59,7 @@ import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
 import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -31,7 +31,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -46,6 +45,7 @@ import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
 import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";

package/src/user-data-rights/feature.ts

@@ -161,14 +161,13 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // "single-user" via appOverrides (TENANT_MODEL_CONFIG_KEY) so the forget
     // pipeline may erase the tenant's data as that user's personal data — still
     // gated by a runtime sole-member check in run-forget-cleanup.
-    r.config({
-      keys: {
-        tenantModel: createSystemConfig("select", {
-          default: "multi-user",
-          options: ["single-user", "multi-user"],
-        }),
-      },
-    });
+    r.configKey(
+      "tenantModel",
+      createSystemConfig("select", {
+        default: "multi-user",
+        options: ["single-user", "multi-user"],
+      }),
+    );
 
     // S2.U3 Atom 1b — ExportJob-Lifecycle-Entity.
     r.entity("export-job", exportJobEntity);

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -29,8 +29,8 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 
@@ -127,7 +127,10 @@ export const downloadByJobQuery = defineQueryHandler({
       });
     }
 
-    const provider = await createFileProviderForTenant(
+    // Provider bound explicitly to the job's tenant — NOT the ambient
+    // session tenant (cross-tenant-same-user: job.requestedFromTenantId
+    // can differ from query.user.tenantId).
+    const provider = await resolveTenantFileProvider(
       ctx,
       jobRow.requestedFromTenantId,
       "user-data-rights:query:download-by-job",

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -31,8 +31,8 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -181,9 +181,10 @@ export const downloadByTokenQuery = defineQueryHandler({
       });
     }
 
-    // Step 5: signed-URL via provider. createFileProviderForTenant nutzt
-    // requestedFromTenantId (gleicher Tenant wie beim Worker-Storage-Write).
-    const provider = await createFileProviderForTenant(
+    // Step 5: signed-URL via provider, explicitly bound to the job's
+    // tenant — NOT the ambient request tenant (anonymous magic-link path
+    // has none under resolverTrust: "authoritative").
+    const provider = await resolveTenantFileProvider(
       ctx,
       jobRow.requestedFromTenantId,
       "user-data-rights:query:download-by-token",

package/src/user-data-rights/lib/tenant-file-provider.ts

@@ -0,0 +1,62 @@
+// Resolves the GDPR-download file-storage provider explicitly for
+// `jobRow.requestedFromTenantId` instead of the ambient request tenant.
+//
+// Both download handlers (by-token, by-job) used to call
+// `createFileProviderForTenant(ctx, jobRow.requestedFromTenantId, ...)`,
+// which reads the PROVIDER SELECTION from `ctx.config` — bound to the
+// caller's own ambient tenant, not the job's tenant:
+//   - by-token (anonymous magic-link, httpRoute): under
+//     `resolverTrust: "authoritative"` without `defaultTenantId` there is
+//     no ambient tenant at all — `ctx.config` throws, 500s the whole
+//     GDPR download flow.
+//   - by-job (session-authed): a user can own jobs across tenants
+//     (cross-tenant-same-user); the ambient session tenant silently
+//     picks the WRONG tenant's provider config for a job requested from
+//     a different tenant.
+//
+// Fix: build a fresh config accessor bound explicitly to the given
+// tenantId (same construction as `makeTenantStorageProviderResolver`,
+// which the export/forget crons already use), instead of the ambient
+// `ctx.config`. Deliberately NOT `ctx._fileProviderResolver` — that
+// resolver is boot-built and per-tenant-cached for the process lifetime,
+// so an operator switching `file-foundation:config:provider` mid-session
+// wouldn't take effect until the cache evicts.
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { createConfigAccessor } from "../../config";
+import { createFileProviderForTenant } from "../../file-foundation";
+
+export interface TenantFileProviderCtx {
+  readonly registry?: Registry;
+  readonly configResolver?: ConfigResolver;
+  readonly secrets?: SecretsContext;
+  readonly db: { readonly raw: DbConnection | TenantDb };
+}
+
+export async function resolveTenantFileProvider(
+  ctx: TenantFileProviderCtx,
+  tenantId: string,
+  handlerName: string,
+): Promise<FileStorageProvider> {
+  if (!ctx.registry || !ctx.configResolver) {
+    throw new Error(
+      `${handlerName}: ctx.registry/ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+    );
+  }
+  const config = createConfigAccessor(
+    ctx.registry,
+    ctx.configResolver,
+    tenantId as TenantId, // @cast-boundary engine-payload: TenantId brand
+    SYSTEM_USER_ID,
+    ctx.db.raw,
+    ctx.secrets,
+  );
+  return createFileProviderForTenant(
+    { config, registry: ctx.registry, secrets: ctx.secrets, _userId: SYSTEM_USER_ID },
+    tenantId,
+    handlerName,
+  );
+}

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -18,7 +18,6 @@ import {
 import { expectErrorIncludes, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -28,6 +27,7 @@ import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";

package/src/user-profile/handlers/change-email.write.ts

@@ -6,8 +6,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { AuthErrors, verifyPassword } from "../../auth-email-password";
-import { decryptStoredPii } from "../../shared";
+import { AuthErrors } from "../../auth-email-password";
+import { decryptStoredPii, verifyPassword } from "../../shared";
 import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 

package/src/auth-email-password/password-hashing.ts

@@ -1,4 +0,0 @@
-// Moved to shared/ — reused across admin-shell, audit, sessions, tenant,
-// user-data-rights, user-profile, and now auth-mfa. Re-exported here for the
-// existing call sites within this feature that import via "./password-hashing".
-export { hashPassword, verifyDummyPassword, verifyPassword } from "../shared/password-hashing";